Harriet Carter Gifts successfully defeated a wiretapping lawsuit on March 24, 2025, when a federal judge ruled that the company and its marketing partner, NaviStone, Inc., did not violate Pennsylvania’s wiretapping laws through website tracking. The U.S.
District Court for the Western District of Pennsylvania granted summary judgment in favor of both defendants, finding that the plaintiff had implicitly consented to the website’s tracking technology through a browsewrap privacy policy. The ruling marked the end of a years-long legal battle that began when plaintiff Ashley Popa visited the Harriet Carter website searching for pet stairs, added items to her cart, and later received targeted direct mail advertisements based on her tracked browsing activity.
Table of Contents
- What Is the Harriet Carter Wiretapping Case and How Did It End?
- The Browsewrap Agreement and the Consent Question
- Who Is NaviStone and How Did the Tracking Work?
- What Does This Ruling Mean for Online Privacy and Consumer Protection?
- The WESCA Law and State-Level Privacy Protections
- Why the Case Took Years to Resolve and What the Appeals Process Revealed
- Implications for Future Privacy Litigation and Website Policies
What Is the Harriet Carter Wiretapping Case and How Did It End?
Ashley Popa’s lawsuit centered on an interpretation of Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (WESCA), a state law that restricts the interception of electronic communications without consent. Popa argued that when she visited the Harriet Carter Gifts website, the company and its third-party marketing services provider, NaviStone, intercepted her shopping session data without her knowledge or explicit permission. She added pet stairs and other items to her shopping cart but left without purchasing. Unbeknownst to her at the time, NaviStone had tracked these activities and the information was later used to deliver targeted advertisements through direct mail.
The case went through multiple rounds of litigation before finally concluding with the defendants’ victory on the merits. The ruling came from judge William S. Stickman IV after the Third Circuit Court of Appeals had actually revived Popa’s claims in August 2022, reversing an earlier dismissal on procedural grounds. Rather than letting the case proceed to trial, the district court granted summary judgment—meaning the judge found that even accepting all of Popa’s factual allegations as true, the defendants had not violated the law. The court determined that Popa had constructive notice of the website’s tracking practices through the privacy policy, which was linked in white text on a blue background in the footer of every page, consistent with industry standards in 2018 when the tracking occurred.
The Browsewrap Agreement and the Consent Question
The centerpiece of the court‘s decision was its finding that the privacy policy constituted a valid browsewrap agreement—a contract formed simply by visiting a website, without clicking an explicit “I Agree” button. Courts have split on whether browsewrap agreements are enforceable, particularly when they rely on inconspicuous links or small text. Harriet Carter’s privacy policy was not hidden behind a pop-up or banner; instead, it was included as a footer link on every page of the website. The white-on-blue color scheme made it visible and distinguishable from other footer links, though it was not the most prominent element on the page. Judge Stickman found this level of notice sufficient to establish that visitors to the website had constructive knowledge of the privacy statement.
When Popa continued browsing and shopping on the website after this notice was available to her, the court reasoned that she implicitly consented to the terms outlined in the policy. However, a critical limitation of this ruling is that it does not address whether the privacy policy’s *content* adequately disclosed the tracking practices. The court’s decision hinges on whether Popa had notice of the policy itself, not whether the policy clearly explained that third-party marketing companies would track her behavior for targeted advertising purposes. Courts in other jurisdictions have sometimes required more explicit consent when websites track users for advertising, particularly if the practices are not prominently disclosed in plain language. This means that while Harriet Carter won because a privacy policy existed and was visible, a future case could still succeed if it could show that similar tracking was conducted without any disclosure whatsoever, or if the disclosure was buried so deep in technical language that no reasonable person would understand it.
Who Is NaviStone and How Did the Tracking Work?
NaviStone is a third-party marketing services provider—a company hired by retailers to collect and use customer data for targeted advertising campaigns. In Popa’s case, NaviStone’s tracking code was embedded on the Harriet Carter website to monitor what products visitors viewed, what items they added to their carts, and whether they completed a purchase. This type of tracking is common in e-commerce: it allows companies to retarget customers with advertisements for products they viewed but did not buy. NaviStone’s specific approach was to use this data not for online retargeting ads, but for offline direct mail campaigns.
When Popa received catalogs and advertisements in the mail promoting similar products to what she had browsed on the Harriet Carter website, that targeting had been informed by NaviStone’s tracking of her session data. The court’s decision to rule in NaviStone’s favor was somewhat surprising to some observers because NaviStone, as a third party, might have been viewed as an intermediary “intercepting” communications between Popa and Harriet Carter. However, the district court had already addressed this issue in the initial 2021 ruling: it determined that because Popa was communicating with NaviStone’s tracking infrastructure as part of her interaction with Harriet Carter’s website, and because she had notice of this through the privacy policy, NaviStone was not surreptitiously intercepting her communications. The Third Circuit’s 2022 reversal had suggested there might be more to the wiretapping argument, but the district court’s 2025 decision found that once consent was established through the browsewrap policy, NaviStone’s role became legally permissible.
What Does This Ruling Mean for Online Privacy and Consumer Protection?
The Harriet Carter decision signals that federal courts, at least in the Third Circuit jurisdiction covering Pennsylvania, New Jersey, and Delaware, are willing to uphold browsewrap privacy policies as evidence of implied consent to website tracking, even when users do not actively click to agree. This is a significant victory for e-commerce companies and adtech firms, as it reduces the legal risk of tracking users’ browsing behavior when any privacy disclosure is present on the website. For consumers, the practical implication is that simply visiting a website with a visible privacy policy may be interpreted as consent to the tracking and data practices described—or even to those practices more broadly, depending on how courts interpret “constructive notice.” However, this ruling has important limitations that consumers should understand.
The decision does not eliminate privacy rights; rather, it shifts the burden to users to review privacy policies before visiting websites. If a privacy policy is genuinely hidden—tucked behind a pop-up that must be closed, or so light in color that it cannot be read—courts might still find insufficient notice. Additionally, if a tracking practice goes beyond what the privacy policy discloses, or if the policy uses vague language that could reasonably be interpreted as allowing only certain types of tracking, a plaintiff might still have a claim. The Harriet Carter ruling is not a universal shield for all tracking practices; it is a ruling specific to this case’s facts, where a privacy policy was visible and the tracking practiced matched, at a high level, what would be expected from a standard e-commerce website operation.
The WESCA Law and State-Level Privacy Protections
Pennsylvania’s Wiretapping and Electronic Surveillance Control Act is one of the most stringent wiretapping laws in the United States. It criminalizes the interception of wire, oral, or electronic communications without all-party consent—meaning both the sender and the receiver must agree. This is notably stricter than federal law, which often requires only one-party consent. Because of Pennsylvania’s tough stance on surveillance, the state has been a hotbed for privacy litigation, with numerous class actions filed against companies that track website visitors or monitor employee communications. The Harriet Carter case was one of these aggressive privacy lawsuits, attempting to stretch WESCA to cover website tracking that occurs as a standard part of e-commerce operations.
The court’s decision effectively narrowed the scope of what WESCA can prohibit when a website includes a privacy policy. One important caveat is that this ruling applies specifically to the Third Circuit and Pennsylvania courts; other states with their own wiretapping laws might reach different conclusions. For example, California has its own strict privacy laws, and California courts might not accept a browsewrap policy as sufficient consent in the same way the Pennsylvania court did. Additionally, future litigation could emerge if the facts differ—such as if a company actively hid its privacy policy, or if the privacy policy claimed one thing while the actual tracking practices did something entirely different. The ruling does not give companies a free pass to ignore privacy; it simply says that having a visible privacy policy on a website can constitute sufficient notice of tracking to defeat a WESCA claim based on lack of consent.
Why the Case Took Years to Resolve and What the Appeals Process Revealed
The path to the March 2025 ruling was longer than many expected, spanning from the initial filing in 2019 through multiple court decisions. The district court’s first ruling in 2021 dismissed the case on procedural grounds, finding that NaviStone, as a party to the electronic communications between Popa and the website, was not “intercepting” them in the way WESCA contemplated. This reasoning suggested that the law might not apply to website tracking at all. However, in August 2022, the Third Circuit Court of Appeals disagreed and revived the wiretapping claims, reasoning that a plaintiff’s allegation that third-party tracking occurred should survive a motion to dismiss.
This reversal sent the case back to district court for further proceedings. The Third Circuit’s decision to revive the claims was important because it suggested that WESCA might have broader application to adtech and website tracking than companies had hoped. However, the district court’s 2025 return to judgment in favor of the defendants showed that even if WESCA *could* theoretically apply, the defendants had a strong defense: implied consent through a visible privacy policy. The progression of this case illustrates how appeals can shift the trajectory of litigation, but also how a case can travel through the appellate system only to return to the same outcome once the merits are fully examined.
Implications for Future Privacy Litigation and Website Policies
The Harriet Carter decision will likely influence how other privacy cases proceed in the Third Circuit and beyond. Companies that have been concerned about WESCA exposure may now feel emboldened to maintain existing tracking practices, provided they include a visible privacy policy. However, privacy advocates argue that this ruling elevates form over substance—a company could theoretically put a privacy policy in barely-readable text and still claim constructive notice. Future litigation may focus on cases where the privacy policy is genuinely difficult to find, or where tracking practices diverge significantly from what the policy describes.
Looking forward, the broader landscape of privacy regulation may shift this calculus. Several states are implementing comprehensive privacy laws similar to California’s, with requirements that go beyond WESCA to mandate explicit opt-in consent for certain types of tracking, particularly for behavioral advertising. A federal privacy law, should one be enacted, might also impose stricter standards than what Pennsylvania courts have accepted in the Harriet Carter case. In the meantime, the ruling serves as a reminder that state wiretapping laws, while protective in principle, can be narrowly applied when companies take even basic steps to disclose their tracking practices.
You Might Also Like
- New Securities Lawsuit Targets ImmunityBio Over Alleged Shareholder Losses
- Standards Home Health Data Breach Prompts Lawsuit Investigation
- Sexual Harassment Lawsuit Tied to Famous California Wine Estate Reaches Settlement
Open Settlements You Can Claim Now
Browse current class action settlements accepting claims — several require no proof of purchase: